The Agent Skills Directory

Capability-Based API Design: The skill instructs developers to design APIs around logical resources rather than broad service access. This design pattern facilitates the principle of least privilege by allowing users to grant access to specific documents or repositories rather than an entire account.
Manual Approval and Audit Logging: The implementation of the ApprovalQueue API is a central security feature. It ensures that any action with externally visible side effects must be submitted and logged, requiring manual user intervention via applyAction before it is executed.
Data Observation Safeguards: The 'Observer verification' system allows Gatekeepers to verify that collaborators in a shared workspace have the necessary permissions to see data previously retrieved by the agent. Strategies like 'Private-only' and 'ACL check' provide flexible ways to handle sensitive information.
Secure Authentication Skeleton: The provided code skeleton includes standard security practices for authentication flows, such as the use of nonces and the crypto.subtle.timingSafeEqual method to prevent timing attacks during credential validation.
Indirect Prompt Injection Mitigations: While the skill handles untrusted data from external service APIs, it addresses the associated risks by mandating read-authorization (authorizeObservation) and providing structures to sanitize or transform data before it is presented to the agent.

write-gatekeeper